Performance and Benchmarks

Circom

In summary:
Both native witness generation and proof generation are generally faster than snarkjs in the browser, with potential speed improvements of up to 20 times.
However, performance varies across different circuits. We recommend developers benchmark their custom circuits before selecting tools for app development.

warning

• witnesscalc hasn't been integrated in mopro. See zkmopro/mopro#110.
• circom-witness-rs is not fully compatible with circom circuits. See: zkmopro/mopro#32.
• wasmer doesn't work in iOS. See: zkmopro/mopro#109.
• Tachyon performs well in macOS, but we haven't integrated it in mobile. See zkmopro/mopro#143

iOS

Benchmarks on an iPhone 16 Pro (2024).

Witness generation	witnesscalc	circom-witnesscalc	wasmer	w2c	snarkjs
Keccak256	142.1 ms (~1x)	75.4 ms (~2x)	287.7 ms (slower)	140 ms (~1x)	147.1 ms
SHA256	41 ms (~2x)	51.3 ms (~1.7x)	171.3 ms (slower)	93.9 ms (~1x)	91.8 ms
RSA	153 ms (~19x)	-	2937.5 ms (~1x)	2312.3 ms (~1.2x)	2979.5 ms
Semaphore	22 ms (~3.5x)	14.6 ms (~5.3x)	266.5 ms (slower)	38.9 ms (~2x)	77.6 ms
Anon Aadhaar	285.1 ms	-	3284.7 ms	1490.8 ms	-

Proof generation	rapidsnark	ark-works	snarkjs
Keccak256	630.3 ms (~8.2x)	956.9 ms (~5.4x)	5182.1 ms
SHA256	186.7 ms (~8.2x)	498.6 ms (~3x)	1487 ms
RSA	749.1 ms (~8.8x)	2250.8 ms (~3x)	6604.5 ms
Semaphore	143.3 ms (~6.9x)	151.4 ms (~6.6x)	1001.6 ms
Anon Aadhaar	3131.7 ms	10681.6 ms	-

info

Details: Spreadsheet of Circom benchmark (iOS)

Android

Benchmarks on an Samsung S23 Ultra (2023).

Witness generation	witnesscalc	circom-witnesscalc	wasmer	w2c	snarkjs
Keccak256	101.4 ms (~3x)	71 ms (~4x)	507.3 ms (slower)	210.5 ms (~1.3x)	292.3 ms
SHA256	29 ms (~5x)	44 ms (~3.5x)	271.6 ms (slower)	106.9 ms (~1.4x)	157.9 ms
RSA	155 ms (~25x)	-	4723 ms (slower)	3751 ms (~1x)	3958 ms
Semaphore	10.3 ms (~7x)	14.7 ms (~5x)	416.9 ms (slower)	32.8 ms (~2x)	74.1 ms
Anon Aadhaar	365.1 ms (~8.7x)	-	5359.6 ms (slower)	2716.4 ms (~1.1x)	3207.5 ms

Proof generation	rapidsnark	ark-works	snarkjs
Keccak256	743.7 ms (~14x)	2330.4 ms (~4.7x)	11096.4 ms
SHA256	228.4 ms (~15x)	1575.2 ms (~2x)	3514.8 ms
RSA	950 ms (~14x)	5839 ms (~2.3x)	13442 ms
Semaphore	165.8 ms (~13x)	276.9 ms (~7.7x)	2146 ms
Anon Aadhaar	3394.5 ms (~15x)	33239.2 ms (~1.5x)	51546.3 ms

info

Details: Spreadsheet of Circom benchmark (Android)

macOS

Benchmarks on an Macbook Pro M1 Max (2021).

Witness generation	witnesscalc	circom-witnesscalc	wasmer	w2c	snarkjs
Keccak256	63.9 ms (~5x)	69.6 ms (~5x)	507.7 ms (slower)	214.6 ms (~1.6x)	348.7 ms
SHA256	22 ms (~10x)	32 ms (~7x)	272 ms (slower)	112 ms (~2x)	225 ms
RSA	164 ms (~29x)	-	5326 ms (slower)	4796 ms (slower)	4777 ms
Semaphore	7.1 ms (~18x)	5 ms (~26x)	287 ms (slower)	34.9 ms (~3.7x)	130 ms
Anon Aadhaar	324 ms (~10x)	-	5369 ms (slower)	2902 ms (~1.2x)	3437 ms

Proof generation	rapidsnark	ark-works	snarkjs
Keccak256	528 ms (~7x)	1161 ms (~3.3x)	3873 ms
SHA256	158 ms (~9x)	779 ms (~2x)	1462 ms
RSA	676 ms (~8x)	3005 ms (~1.8x)	5553 ms
Semaphore	112 ms (~7.8x)	84 ms (~10x)	877 ms
Anon Aadhaar	2421 ms (~8x)	14142 ms (~1.3x)	19794 ms

info

Details: Spreadsheet of Circom benchmark (host)

Halo2

In summary:
The performance of the Mopro build is comparable to the native Halo2 build.

The bellow tests were run on a Macbook Pro M1 Pro (2021) as well as an iPhone 15 Pro (2023).

Keccak256	Prove Time (s)	Verify Time (s)
Native (M1 Pro)	10.3 s	0.15 s
Emulator (M1 Pro)	10.1 s	0.13 s
iPhone 15 Pro	11.0 s	0.12 s

RSA	Prove Time (s)	Verify Time (s)
Native (M1 Pro)	76.5 s	11.1 s
Emulator (M1 Pro)	64.5 s	9.0 s
iPhone 15 Pro	crashes	crashes

Note that the iPhone 15 Pro crashes when running the RSA circuit due to the large memory requirements. The circuit needs around 5GB of memory to run, while the iPhone 15 Pro usually limits the application memory usage to 3GB.